5 ms·

If you got the laptop in a sealed Apple box (purchased by employer), and set up macOS yourself, created your own admin user and everything, does this remote acc

If you got the laptop in a sealed Apple box (purchased by employer), and set up macOS yourself, created your own admin user and everything, does this remote access still apply?

deleted 5y ago
[deleted]
gostsamo 5y ago
Yes, it does. The employer has registered in front of Apple the serial number and Apple considers the device theirs. MDM on an employer's laptop allows them full control. If the device is owned by the user, then the MDM is more limited.
- GekkePrutser 5y ago
  It's actually the vendor that registers Macs. Only iOS devices can be registered to Apple DEP manually. Macs can't, only the vendor can do so, whether it's Apple or whoever else.
- underwater 5y ago
  Are you saying the employer can take control of the device without ever having physical access to it? That sounds like a massive privacy and security issue. Do you have more information?
  - gostsamo 5y ago
    I was researching MDM more than an year ago, but keep in mind that we are talking for an employer's machine. Here is the overview: https://support.apple.com/guide/mdm/mdm-overview-mdmbf9e668/web https://support.apple.com/guide/mdm/mdm-overview-mdmbf9e668/...
    - underwater 5y ago
      It would still need on-device authorisation to opt into MDM though. I can't just give Apple your serial number and tell them to start pushing updates to your device, can I?
      - gostsamo 5y ago
        At the time of purchase, the vendor knows which machines the employer buys and assigns them the relevant privileges. When the machine is initially opened, it connects to Apple and is provided with the address of its mothership server. The MDM server then instructs the machine what to download and how to configure it. The user has just to unbox the machine and nothing else. This is convenient because it allows for downloading multiple apps, installation and configuration of certificates, setting password policies and many other actions that users are really prone to mess up, and that are wasting lots of sysadmin time if done manually one by one. If the user owns the machine, then there must be authorization and the MDM has much more limited, privacy-preserving scope.
        R0b0t1 5y ago
        I think they are asking if you could social engineer access to someone's laptop by knowing their serial and calling enterprise support. Seems to me like you could.
        gostsamo 5y ago
        @R0b0t1 No, you can't. The employer has proof of ownership because they buy the machine.
        underwater 5y ago
        That's really surprising. I suppose it makes sense if it happens at the time of setting up the machine, and an explicit notice is given to the end user. That should circumvent any privacy and security issues.
rz2k 5y ago
In that case you should know whether a management profile[1] has been installed, but you shouldn't assume you can simply create another admin account. [1] https://support.apple.com/guide/server/intro-to-profile-manager-apd0e2214c6/mac https://support.apple.com/guide/server/intro-to-profile-mana...
- Hamuko 5y ago
  If I don't see a Profiles section in my System Preferences, does this mean that my employer has a very high level of trust in me?
  - mike_d 5y ago
    It means your employer has a very low level of security and you should be genuinely concerned about any personal or financial information you gave them during your hiring.
    - Hamuko 5y ago
      Seems like a vast overstatement.
      - mike_d 5y ago
        Endpoint management is like bare minimum security basics. At this point luck is the only thing stopping a BEC or ransomware attack.
        siva7 5y ago
        nonsense. there is no one-size-fits-all solution for security.
        mike_d 5y ago
        That is like arguing "not all cars need seatbelts." You might disagree on how many airbags or crash avoidance widgets a car needs, but the vast majority of the industry agrees that seatbelts are a requirement.
jcims 5y ago
This entirely depends on what you do from that point forward. Are you using a VPN provided by your employer? Are you installing any screen sharing or collaboration apps for work? You'll need to understand what each of these are capable of in order to fully understand your exposure.

If you got the laptop in a sealed Apple box (purchased by employer), and set up macOS yourself, created your own admin user and everything, does this remote access still apply?

deleted 5y ago

[deleted]

gostsamo 5y ago

Yes, it does. The employer has registered in front of Apple the serial number and Apple considers the device theirs. MDM on an employer's laptop allows them full control. If the device is owned by the user, then the MDM is more limited.

GekkePrutser 5y ago
It's actually the vendor that registers Macs. Only iOS devices can be registered to Apple DEP manually. Macs can't, only the vendor can do so, whether it's Apple or whoever else.
underwater 5y ago
Are you saying the employer can take control of the device without ever having physical access to it? That sounds like a massive privacy and security issue. Do you have more information?
- gostsamo 5y ago
  I was researching MDM more than an year ago, but keep in mind that we are talking for an employer's machine. Here is the overview: https://support.apple.com/guide/mdm/mdm-overview-mdmbf9e668/web https://support.apple.com/guide/mdm/mdm-overview-mdmbf9e668/...
  - underwater 5y ago
    It would still need on-device authorisation to opt into MDM though. I can't just give Apple your serial number and tell them to start pushing updates to your device, can I?
    - gostsamo 5y ago
      At the time of purchase, the vendor knows which machines the employer buys and assigns them the relevant privileges. When the machine is initially opened, it connects to Apple and is provided with the address of its mothership server. The MDM server then instructs the machine what to download and how to configure it. The user has just to unbox the machine and nothing else. This is convenient because it allows for downloading multiple apps, installation and configuration of certificates, setting password policies and many other actions that users are really prone to mess up, and that are wasting lots of sysadmin time if done manually one by one. If the user owns the machine, then there must be authorization and the MDM has much more limited, privacy-preserving scope.
      - R0b0t1 5y ago
        I think they are asking if you could social engineer access to someone's laptop by knowing their serial and calling enterprise support. Seems to me like you could.
      - gostsamo 5y ago
        @R0b0t1 No, you can't. The employer has proof of ownership because they buy the machine.
      - underwater 5y ago
        That's really surprising. I suppose it makes sense if it happens at the time of setting up the machine, and an explicit notice is given to the end user. That should circumvent any privacy and security issues.

rz2k 5y ago

In that case you should know whether a management profile[1] has been installed, but you shouldn't assume you can simply create another admin account. [1] https://support.apple.com/guide/server/intro-to-profile-manager-apd0e2214c6/mac https://support.apple.com/guide/server/intro-to-profile-mana...

Hamuko 5y ago
If I don't see a Profiles section in my System Preferences, does this mean that my employer has a very high level of trust in me?
- mike_d 5y ago
  It means your employer has a very low level of security and you should be genuinely concerned about any personal or financial information you gave them during your hiring.
  - Hamuko 5y ago
    Seems like a vast overstatement.
    - mike_d 5y ago
      Endpoint management is like bare minimum security basics. At this point luck is the only thing stopping a BEC or ransomware attack.
      - siva7 5y ago
        nonsense. there is no one-size-fits-all solution for security.
        mike_d 5y ago
        That is like arguing "not all cars need seatbelts." You might disagree on how many airbags or crash avoidance widgets a car needs, but the vast majority of the industry agrees that seatbelts are a requirement.

jcims 5y ago

This entirely depends on what you do from that point forward. Are you using a VPN provided by your employer? Are you installing any screen sharing or collaboration apps for work? You'll need to understand what each of these are capable of in order to fully understand your exposure.